IdPv3 and Hathitrust: how to resolve and release SAML

[Wang, Lihua]

Hi Scott,

Thanks for your response. 

Below is from Sp's web site:

"SAML V2.0 persistent NameID (urn:oasis:names:tc:SAML:2.0:nameid-format:persistent) OR eduPersonTargetedID (required) - to offer collection-building services
If an institution does not yet have support for persistent NameID or eduPersonTargetedID, we will accept eduPersonPrincipalName with the understanding that if a user's eduPersonPrincipalName were to change, their saved personalized HT environment would no longer be available to them."

In the worst case, we probably could resolve sAMAccountName or some other attribute to eppn, but it seems best to be able to use persistentNameID based on the above description.

We use active directory in the backend for authentication. What is generally recommended as the seed for computedID?

Thanks again!

Lihua

Message: 2
Date: Fri, 7 Jul 2017 19:28:13 +0000
From: "Cantor, Scott" <cantor.2 at osu.edu>
To: Shib Users <users at shibboleth.net>
Subject: Re: IdPv3 and Hathitrust: how to resolve and release SAML
	V2.0 persistent NameID
Message-ID: <5371E6A2-AD0B-4719-9F99-D99EC7D216C1 at osu.edu>
Content-Type: text/plain; charset="utf-8"

On 7/7/17, 3:19 PM, "users on behalf of Wang, Lihua" <users-bounces at shibboleth.net on behalf of lwang2 at gc.cuny.edu> wrote:

> But what do we need to do to resolve the persistent NameID and release it to a service provider?

Define sAMAccountName as a resolved attribute, and use an appropriate mechanism to trigger the use of that Format. An InCommon SP's metadata will not do that for you, so they ideally shouldn't be using NameIDs at all, but you'd have to force the right Format to get chosen. You either add a NameIDFormat at runtime to the metadata using a metadata filter, or you have to configure a relying party override with a nameIDFormatPrecedence setting to force it.

You can't just configure the format. It has to be chosen. The set of NameID Formats is infinite. There is no way for the IdP to know which one to use. Either the SP asks, its metadata specifies it, or you tell it. Otherwise you get the default, and the default is "transient".

Personally I wouldn't bother, and I would not use sAMAccountName as a seed. What are you using in AD for that? Anything that's not stable is not appropriate as an input to that process, and most of those tend to be usernames or other questionably stable data.

If this SP doesn't *require* all this, then I wouldn't bother. And I don't think it does.

-- Scott



------------------------------

Subject: Digest Footer

--
To unsubscribe from this list send an email to users-unsubscribe at shibboleth.net

------------------------------

End of users Digest, Vol 73, Issue 24
*************************************